PT-2026-3872 · Copier · Copier

Cbrown1234 · Publicado 2026-01-21 · Atualizado 2026-01-22 · CVE-2026-23986

Positive Technologies (AI Summary)

CVSS v3.1

7.1

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Copier versions prior to 9.11.2

Description Copier, a library and CLI app for rendering project templates, allows a malicious template author to overwrite arbitrary files. This occurs because a safe template can write to directories outside the intended destination path by utilizing a symlink with preserve symlinks: true and a generated directory structure where the rendered path resides within the symlinked directory. The exploit is non-deterministic, as Copier uses os.scandir which yields directory entries in an arbitrary order. The issue allows overwriting files based on the user's write permissions.

Recommendations Update Copier to version 9.11.2 or later.

Exploit

Correção

Enumeração de Fraquezas

CWE-61

Identificadores relacionados

CVE-2026-23986

GHSA-4FQP-R85R-HXQH

Produtos afetados

Copier

Referências · 11

• 🔥 https://github.com/copier-org/copier/security/advisories/GHSA-4fqp-r85r-hxqh · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23986.json · Exploit
• https://github.com/copier-org/copier · Nota
• https://github.com/copier-org/copier/commit/b3a7b3772d17cf0e7a4481978188c9f536c8d8f6 · Correção
• https://github.com/copier-org/copier/releases/tag/v9.11.2 · Nota
• https://twitter.com/VulmonFeeds/status/2014189741869072504 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-4fqp-r85r-hxqh · Aviso do Fabricante
• https://t.me/CVEtracker/42705 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-23986 · Nota de Segurança
• https://twitter.com/CVEnew/status/2014116180626174196 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-23986 · Aviso do Fabricante